                 (wrap-info e internal-server-error)))))
         (handler request)))))
 
+
 (defmethod ig/pre-init-spec :akvo.lumen.auth/wrap-api-authorization [_]
   (s/keys :req-un [::p/authorizer]))

;;; Authorization helpers
;;;

;; Currently Keycloak API authz is not available when authenticating with Auth0
;; but only for users with app_metadata set to true in path -> lumen -> features
;; -> apiAuthz and akvo.org email.
(defn api-authz? [{:strs [email email_verified] :as jwt-claims}]
  (let [flag-path ["https://akvo.org/app_metadata" "lumen" "features"
                   "apiAuthz"]
        flag (get-in jwt-claims flag-path)]
    (and (and (some? flag) flag)
         (and (some? email_verified) email_verified)
         (and (some? email) (string/ends-with? email "@akvo.org")))))

(defn- application-json-type
  "code taken from ring.middleware.json/wrap-json-response"

  be configured via the KEYCLOAK_URL env var."
  [keycloak-public-client auth0-public-client authorizer]
  (let [keycloak-verifier (RSASSAVerifier. (:rsa-key keycloak-public-client))
        auth0-verifier (RSASSAVerifier. (:rsa-key auth0-public-client))]
    (fn [handler]
      (fn [{:keys [tenant] :as req}]
        (if-let [token (jwt/jwt-token req)]
